Split AclBasedSecurity into two: an ACL-based AccessManager implementation that does not rely on Guards, and an AccessManager implementation that evaluates Guards but is independent on a particular model (such as the AclBasedSecurity model)

Eliminated org.infogrid.model.AclBasedSecurity, and instead introduced org.infogrid.meshbase.security.aclbased, which also includes a model

DelegatingAccessManager now supports delegating to multiple other AccessManagers, all of which must agree

added ThreadIdentityManager.suExec

When there isn’t a ProtectionDomain, it’s free for all in AclBasedAccessManager

moved org.infogrid.model.SecurityTest into the attic; currently not used

pass SaneUrl through to ViewletFactory, so it can access request attributes

created org.infogrid.jee.security.aclbased tag library for AclBasedSecurity Subject Area

added TextStructuredResponseSection.containsContent

replaced ViewletAlternativesTag.js with more general-purpose ToggleCssClass.js

support redirect to newly created object in HttpShell

Created BracketTags, which allow conditional generation of, say, <ul> and </ul> tags depending on whether or not the content tag has any non-whitespace content.

factored out AbstractSaneRequest.urlWithoutMatchingArguments for easier reusability

trim entered identifiers before trying to resolve them in HttpShellFilter

Better error reporting for HttpShell

IncludeViewletTag more robust if path not specified

Removed the List<Throwable> in request attribute for collecting processing exceptions; now abstracted into new interface ProblemReporter

Allow null identifiers for create access verb in HttpShell again

hyperlink on UnsafePostException’s message

TitleTag to use a separate section in the StructuredResponse

default mechanism for TitleTag with Viewlet name and app name, can be overridden with TitleTag

<tmpl:title> tag prints <title> tags itself

fixed userVisibleName on Viewlet

JeeViewlets’ default POST URL used to sometimes leave out reached MeshObjects, which would list all found-by-traversal MeshObjects after post, which was very confusing. Removed traversal spec in case there are no reached MeshObjects